You can invoke ADF pages by calling their URL (and possibly pass parameters to them as well) - so you'll add menu options to EBS that call those URL.
In terms of security you might want to look at the EBS JAAS solution:
ADF 11g requires Java EE 5.0 support - and OC4J doesn't provide this.
Therefor your ADF application will be deployed on a different server running WebLogic.
Note though that you can move your EBS to run on WebLogic too - this is certified - and then both can run on the same server.